CVE-2026-86767

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description When Full Multiple Company Support is enabled, the application fails to apply company scope filtering to the 'GET /hardware/requested' endpoint. This allows authenticated users with assets.view permission to access pending asset requests from all companies. This flaw enables the retrieval of cross-tenant data, including requested asset names, requester display names, profile links, locations, and expected check-in dates, without requiring parameter manipulation.

Recommendations Update to version 8.7.0 or later.